topic Re: Checkin when a file has been moved. in Operating System - HP-UX

Checkin when a file has been moved.

Henry Chua — Thu, 09 Dec 2004 21:53:32 GMT

Hi there,

Just want to find out, is there anyway I can find out when a file has been moved in my system. And how can I control the file moving in my system. THank u!!

regards..

Re: Checkin when a file has been moved.

Sridhar Bhaskarla — Thu, 09 Dec 2004 22:54:14 GMT

Hi Henry,

Not quite sure if I understood your question. You check for the existence of a file (moved or deleted or renamed) using 'if'.

if [[ -a /somewhere/file ]]
then
echo "File is there"

else
echo "File is not there"

fi

-Sri

Re: Checkin when a file has been moved.

Henry Chua — Thu, 09 Dec 2004 23:07:50 GMT

Hi Sri,

Actually I am my problem is, some files on my system were moved recently, and I am interested in finding out when these files have been moved. Is there anyway I can do this? THank u!

Cheers
Henry

Re: Checkin when a file has been moved.

Sridhar Bhaskarla — Thu, 09 Dec 2004 23:15:45 GMT

Well.. you will need to enable "Auditing" or install HIDS software on the system. "Auditing" is very easy to configure. It has got less than 5 commands. 'audsys' 'audmon' 'audsys' 'audusr' and 'audisp'. man auditing for more information.

Depending on your configuration, AUditing can generate a lot of data. So, you have to choose the events and system calls (audevent) carefully to monitor. You will need to enable atleast delete,moddac and modaccess events to capture the file modification information. 'audisp' can help you to read the binary data into human readable form. You will need to convert your system to trusted.

On the other hand, if you know the file, then you can probably write a script that runs every x minutes to check the file. It's a very primitive way and you only get the coordinates of the time when the file was (re)moved.

-Sri

Re: Checkin when a file has been moved.

Brian Barrett_1 — Thu, 06 Jan 2005 21:30:40 GMT

For Sridhar Bhaskarla ONLY:

Sri, I apologize in advance for the awkward communique. I was unable to find your email. Also, I apologize for any false presumption of any relation to Alex Bhaskarla. Alex owes me $34 for a December Ebay transaction. And I am attempting to collect independently. Please contact me for further information.

Regards,
Brian Barrett
libran3@excite.com
541-490-5376

PS This message content in no way reflects the integrity of Sri. By all accounts on this message board, Sri is a generous, honest, and helpful individual.

Re: Checkin when a file has been moved.

Mic V. — Thu, 06 Jan 2005 22:32:10 GMT

Basically, no, assuming as written above that it's a vanilla (normal HP-UX) system.

But there are some things you can do might give you some ideas.

The most fruitful idea is to make use of your backup software. If files are there one day and not the next, you have some idea when they were moved. The down sides are you have to know what the files are (or else be able to "diff" two lists of files given to you by the backup software), it's time-consuming, and not very accurate.

Another, not usually very useful--you can look at the date on the parent directory. If the directory doesn't change much, it can at least give you an idea as to when something was moved.

Looking at the permissions on a directory can help you figure out who may have made a change.

As far as controlling who can move files, standard UNIX permissions (chown, chgrp, chmod) are the usual way. There are also extended ACLs available on, I believe, only HFS filesystems (this type of filesystem is no longer widely used). Another way to control who can move files is to write a "wrapper" program that takes a request, decides if the request is ok, and moves a file (on the user's behalf) only if the request is ok. I'm sure there are other things, but this is what comes to mind.

HTH.